Engineering guide / MCP security
Review an MCP connection
before it reaches production.
Start with what a server can do, what it can read and which operations require approval. A familiar product name or an HTTPS URL does not answer those questions.
Inspect the startup boundary
A local MCP server is executable software running with the permissions of its process. Review the executable, arguments, package source and version. A plain argument array is different from passing a string to a shell. Treat download-and-execute bootstrap scripts and elevated launchers as review points, not routine setup steps.
Make resource access explicit
A filesystem tool rarely needs the whole home directory. A container with the Docker socket can influence the host through the Docker API. Scope directories, network destinations and API permissions to the workflow. Check enforcement in the actual runtime, not only in a configuration file.
Account for the client and operating system
Cursor and VS Code use different configuration and approval mechanisms. VS Code's per-server MCP sandbox is documented for macOS and Linux. A setting copied into an unsupported format or platform does not establish isolation. Review global settings and workspace overrides together.
Keep credentials outside shared files
Use the secret or input mechanism supported by the client. Replacing a token with an environment reference helps keep the file shareable, but does not establish that the token has minimal privileges. Verify scopes, expiry and rotation in the system that issues it.
Understand the prompt injection boundary
Tool descriptions and responses can bring untrusted instructions into an agent's context. A configuration review cannot reproduce that behavior. Enforce authorization and sensitive-action approvals outside the model. A prompt that asks the agent to be careful is not an access-control mechanism.
Prepare an assessment brief
- Which agent workflows are already in production?
- Which systems can tools read from and write to?
- What requires human approval, and where is it enforced?
- What data may leave the environment?
- Who owns fixes, and what is the release deadline?
Start with sanitized configurations and a system diagram. Share production credentials with neither this scanner nor an initial sales inquiry.